Should we get mad at the user if username is provided but password isn't, or vice versa?